HarborGuard / CVE
Back to search
HIGHCVE-2026-32286Published Modified CNA Go

CVE-2026-32286: Denial of service in github.com/jackc/pgproto3/v2

The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.

Metrics

CVSS v3.1
7.5
Severity
HIGH
Fixed in
0
Affected Products
1

Fix available

0
Affected packages
  • github.com/jackc/pgproto3/v2 / github.com/jackc/pgproto3/v2
    Fixed in 0
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References